{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mongoose--7.0.0--7.8.13/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mongoose:mongoose:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-125119"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Mongoose (\u003e= 6.0.0, \u003c 6.13.12)","Mongoose (\u003e= 7.0.0, \u003c 7.8.13)","Mongoose (\u003e= 8.0.0, \u003c 8.24.7)","Mongoose (\u003e= 9.0.0, \u003c 9.11.4)"],"_cs_severities":["high"],"_cs_tags":["web-application","database-security","injection","mongoose","mongodb"],"_cs_type":"advisory","_cs_vendors":["Mongoose"],"content_html":"\u003cp\u003eMongoose fails to apply the sanitizeFilter security option when configured at the connection level via \u003ccode\u003emongoose.connect()\u003c/code\u003e or \u003ccode\u003ecreateConnection()\u003c/code\u003e. While the connection reports the option as enabled, internal query casting logic fails to reference the configuration, rendering it ineffective. Applications relying on this setting to mitigate query selector injection remain vulnerable to attacks where malicious operators, such as \u003ccode\u003e{ $ne: null }\u003c/code\u003e, are passed into query filters. This issue affects Mongoose versions 6.x, 7.x, 8.x, and 9.x.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAttackers can bypass application-level authentication and data filtering by injecting MongoDB query operators into user-controlled input fields. For instance, passing an operator object as a password or username value can cause the database to return documents that should otherwise be restricted.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Mongoose to a patched version: v6.13.12, v7.8.13, v8.24.7, or v9.11.4.\u003c/li\u003e\n\u003cli\u003eUntil patching is possible, shift from connection-level configuration to global or query-level sanitization:\u003c/li\u003e\n\u003cli\u003eUse global settings: \u003ccode\u003emongoose.set('sanitizeFilter', true)\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eUse query-level settings: \u003ccode\u003eModel.find().sanitizeFilter(true)\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAudit existing application logic for dependencies on connection-level security configurations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T02:05:28Z","date_published":"2026-11-11T02:05:28Z","id":"https://feed.craftedsignal.io/briefs/2026-11-mongoose-sanitizefilter/","summary":"A bug in Mongoose allows MongoDB query selector injection due to the failure of connection-level sanitizeFilter configurations to apply, potentially enabling unauthorized record access.","title":"Mongoose: Connection-level sanitizeFilter bypass (CVE-2026-125119)","url":"https://feed.craftedsignal.io/briefs/2026-11-mongoose-sanitizefilter/"}],"language":"en","title":"CraftedSignal Threat Feed - Mongoose (\u003e= 7.0.0, \u003c 7.8.13)","version":"https://jsonfeed.org/version/1.1"}